Lucene search

K

GitLabCVELIST:CVE-2022-0908

HistoryMar 11, 2022 - 12:00 a.m.

CVE-2022-0908

2022-03-1100:00:00

GitLab

www.cve.org

5

null pointer

memcpy function

libtiff

tiff file

denial of service

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.2%

Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.

CNA Affected

[
  {
    "vendor": "TIFF Software Distribution",
    "product": "libtiff",
    "versions": [
      {
        "version": "<=4.3.0",
        "status": "affected"
      }
    ]
  }
]

References

gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0908.json

gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85

gitlab.com/libtiff/libtiff/-/issues/383

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/

security.gentoo.org/glsa/202210-10

security.netapp.com/advisory/ntap-20220506-0002/

www.debian.org/security/2022/dsa-5108

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.2%

Related for CVELIST:CVE-2022-0908